The Claude Dispatch flaw that Forever Security calls ThisBash Escape shows how a browser extension could reach the operating system through an AI agent. The research firm published its write-up on 4 November 2026. This explainer sets out what Dispatch is, what the researcher says it found, what Anthropic has said, and what defenders can do now.
Everything about the flaw comes from the researcher’s account, which we read in full. We describe the mechanism in general terms and leave out the steps that would help copy it.
What Is Claude Dispatch?
Dispatch is a feature of Claude Cowork that lets a person message Claude from a phone and have it work on their desktop computer. Anthropic’s help article says the task runs on the desktop, using local files, connectors, plugins and apps, so the Claude Desktop app must be open.
The same help article says Dispatch is in limited beta on some Pro, Max and Ultra plans and is not available to new users. It adds that people who already use Dispatch can keep using it for now. That text was on the page when we read it on 6 November 2026.
How Did the Flaw Reach From a Browser to the Computer?
Forever Security says the Dispatch interface and its API were also reachable from an ordinary logged-in claude.ai session. The web version did not show a link to the feature, but the researcher says hiding the link did not restrict access. A browser extension that was allowed to control claude.ai could therefore send instructions to Claude Desktop as if the user had typed them.
- Extension with access to claude.aiBrowseracts inside the user’s session
- Logged-in claude.ai sessionBrowserinstructions look like the user’s own
- Dispatch link between devicesClaude accountrelays the instruction to a paired desktop
- Claude Desktop agentComputertakes the task and asks for approval
- Local commandsComputer
The researcher reports that the phone-to-desktop path itself showed no flaw. The problem it describes is the web route to the same function. It also notes that the paired desktop could be a different computer from the one running the browser.
Why Did Claude’s Guardrails Not Stop It?
Forever Security says Claude hesitated when asked to install an unfamiliar package. In its proof of concept, a follow-up message written in the user’s voice supplied reassurance and the install went ahead. Scripted clicks on the approval buttons handled the rest, and a harmless program opened as proof.
The researcher calls this prompt forcing: the attacker controls the input channel itself, so it can read each reply and adjust. That differs from a prompt injection, where hostile text hides in a page or file the agent reads. Our own prompt injection in AI agents page covers the indirect case.
How Far Can the Claude Dispatch Flaw Reach?
The researcher describes three levels of reach. On one machine it is a sandbox escape, and across two machines it is remote code execution. With a personal account signed in on a work laptop, it becomes entry to a company endpoint. These labels are Forever Security’s.
It also says it has seen personal Claude accounts with cross-device Dispatch enabled on corporate endpoints in customer environments. We cannot check that claim. It does explain why the account, and not only the device, belongs in an endpoint review.
What Has Anthropic Said?
The write-up gives a timeline. Forever Security says it reported the issue to Anthropic on 14 May 2026. On 19 May, the researcher says, Anthropic acknowledged that the findings were valid but closed the report as a duplicate of an issue it had already found internally.
On 13 October 2026 Anthropic stated, according to the researcher, that Dispatch would be retired, targeting the end of October 2026. The write-up describes retirement, not a patch. It also says the flaw stays exploitable until then.
The researcher argues that retiring one feature does not remove the design problem. It says Claude Code Remote Control and Claude Cowork sessions let the web drive a local agent in the same way, and it promises a follow-up post. Anthropic’s side in this post is limited to what the researcher quotes and what the help article says.
What Should Defenders Do About It?
Forever Security recommends five measures, and the checklist below follows its list. The technique mapping after it is ours.
- Inventory the agentsList which Claude Desktop installs exist, which accounts they use, and whether those accounts sit under company single sign-on.
- Switch off cross-device DispatchDisable it where there is no business need. Where it stays, review how devices are paired and how pairings are revoked.
- Treat extensions as endpoint softwareReview the permissions of extensions that can act on claude.ai, control who can install them, and review permission changes.
- Keep approvals out of reach of automationA confirmation shown inside an interface that an extension can operate cannot prove the user approved it.
- Watch what the agent doesLook for unexpected package installs, new persistence and credential access started by Claude Desktop, and ask why they happened. The wording is ours.
In ATT&CK terms, our reading maps the entry to browser extensions (T1176) and the result to command and scripting interpreter use. For extension hygiene see our malicious extensions playbook, and for who the agent acts as, AI agent identity and access. Limiting what the agent may touch follows least privilege.
The account comes from one source, and the write-up closes with an offer of the firm’s own endpoint product. Read the impact claims with that in mind. The mechanism, the dates and Anthropic’s retirement statement are the parts the researcher states directly.